Collaborate Disseminate
I am running Windows 10. I have FTK Imager in my laptop. I have a folder which has 26 Encase image files (.E01, E02, ….. .E26). In FTK imager, I can add E01 file as an evidence. When I try to add the remaining images (E02, … Continue reading Why can’t FTK imager add E02 file (Encase) as an evidence? [on hold]
I have 26 Encase image files (each of them is 1.46 GB). I want to combine them all into one image file. Which tool/software can I use to do that?
Continue reading How to combine multiple Encase image format files into one image file?
I currently have two HFS volumes that I would like to compare in order to see which files have been added or modified. It’s a Mac OS X 10.9 (Mavericks) install.
First volume is the system as of today.
Second volume is a back… Continue reading Diff files between two HFS volumes
I own a Windows laptop. I encrypted it with the Veracrypt system encryption. When the laptop boots, there is a black screen and it asks for the encryption password. There are four partitions on the hard drive when decrypted.
… Continue reading Veracrypt system encryption cloning properly
I take OS first 512 hexdump using dd command. what kind of information extract using that and what are the tools or command(linux) can be used for analysis ?
I take copy bytes dump using my Ubuntu os(MBR sector) following c… Continue reading How to do forensis MBR hex dump?
I can’t seem to find too much on this, but I’m worried after realizing I downloaded my Raspbian image from HTTP, and wrote it into a USB stick without verification.
I’m worried, especially since I don’t trust the security o… Continue reading Could an infected .iso file infect a PC that is running a disc burning or drive imaging program?
Pretty much what the title suggests.
I understand its quite vague so apologies.
I’m just not sure if it’s able to install something that will sit elsewhere on the machine (as in not on the C:) which could then restart the e… Continue reading Will re-imaging kill ransomware?
Emulators are a great way to reminisce about games and software from yesteryear. [Jorj Bauer] found himself doing just that back in 2002, when they decided to boot up Three Mile Island for the Apple II. It played well enough, but for some reason, crashed instantly if you happened to press the ‘7’ key. This was a problem — the game takes hours to play, and ‘7’ is the key for saving and restoring your progress. In 2002, [Jorj] was content to put up with this. But finally, enough was enough – [Jorj] set out to fix the bug in …read more
I’m wondering how can I prove the integrity of a computer forensic evidence which was obtained from a running machine (e.g.: memory image). As soon as I do anything with that box, connect a pendrive for example, I alter the r… Continue reading Integrity of LIVE forensic evidences (e.g. memory dump)
